Have you tried to disable the read/create grant on /dataFlows/dataFlows for Authenticated Users? This will prevent non-admins from creating flow objects that could have a parent URI, but you'd still be able to save to the file system if you've turned on file system access for SAS Studio.
--
Greg Wootton | Principal Systems Technical Support Engineer